IPsec - Domain or Route based

[gm446]

Hi Everyone,

I need to implement a IPsec solution in our organization. We have one Cluster in our data center (6900) and five remote branches with 1800 gateways, all appliances are managed from the same management server.

The required topology is Hub-and-Spoke and the DC is the only exit to the internet. branches are connected to the data center with P2P ISP lines so each remote gateway have interface (WAN) in same subnet with the the dc gateways.

i consider if i should use domain based or route based VPN. what are the benefits for each method?

Thank you in advance,
Yossi.

[the_rock · Accepted solution]

This article explains is PERFECTLY (in my opinion), but I always give customers reasons below to use route based (as pretty much explained in the link)

https://www.ateam-oracle.com/post/policy-based-vs-route-mode-vpn

-faster

-more reliable

-more secure

Hope that helps.

Andy

[gm446]

Great! Thank you

[the_rock]

Of course, we are here to help. Hopefully those reasons are good enough to use route based. Its worth mentioning as well that some vendors now days ONLY actually allow route based tunnels.

Andy

[gm446]

I am actually feel much more comfortable with route based VPN because i have more control over the traffic. I just though there is some down side. but this is actually close the deal.

[the_rock]

Cool, cool...if you have any issues, be free to message directly, I have quite some experience with route based tunnels, as one of my colleagues and I did extensive testing for it few years ago and I also troubleshoot few of those with BGP recently.

Andy

P.S. To help you further, I pasted the post I made about it few months ago, with some screenshots and txt file. Its to Azure, but same applies to AWS, for example.

https://community.checkpoint.com/t5/Security-Gateways/Route-based-VPN-tunnel-to-Azure/m-p/206179/emc...